MiCA Register 2026: Only 21 of 329 Licences Are Real Exchanges

Since 1 July 2026, any platform serving customers in the EU needs a granted MiCA authorisation. An application in progress no longer counts. Anyone who wants to know which firms actually cleared that bar does not have to take a press release on trust: the European Securities and Markets Authority publishes the register of authorised providers as an open file, no login required.

We downloaded that file and worked through all of it. The register is dated 4 August 2026 and was pulled on 6 August. What comes out of it matches the industry's self-description only in part. The most striking finding sits further down and reads: of 329 authorisations, exactly 21 permit the operation of a trading platform.

What the register actually says

At the cut-off date the register holds 329 authorisations, spread across 322 legal entities with their own LEI code and 26 states of the European Economic Area. The gap between the two figures comes down to companies appearing more than once, typically where an authorisation was later extended.

The raw data is available as a CSV. Anyone who wants to redo the arithmetic will find it here: CASPS.csv in the ESMA register. The folder in the path reads 2024-12, but the contents are kept current. The authority's own MiCA overview page is here.

Germany accounts for one authorisation in five

The geographic spread is far more lopsided than the public debate about Malta and Cyprus would suggest. With 72 authorisations Germany leads the field, more than twice as many as second-placed France with 35. The Netherlands follow with 29, Cyprus with 27 and Malta with 22.

Why Germany leads

Together those five countries account for 185 of the 329 authorisations, or 56 per cent. The remaining 21 states share what is left. The German lead has a cause that has little to do with crypto, though: a large share of the domestic authorisations sits with banks, savings-bank networks and investment firms that offer crypto trading as an add-on to an existing business. Of the 72 German authorisations only two permit the operation of a trading platform, and 56 apply to the German market alone.

Germany does not lead because an unusual number of trading venues sprang up here. It leads because the established financial sector filed as a bloc.

The finding that matters most: authorised rarely means exchange

MiCA defines ten separate services, each authorised individually. An authorisation is therefore not a blanket seal but a list of permitted activities. We counted how often each of those ten activities appears in the register.

Custody of crypto-assets is the most common at 221 mentions, followed by transfer services at 206 and exchange for euros or other currencies at 184. At the bottom sits the service most people have in mind when they say "crypto exchange": operating a trading platform appears 21 times. That is 6.4 per cent of all authorisations.

What the difference means in practice

A trading platform under the regulation brings together the orders of different clients in an order book. You trade against other users; the operator only provides the venue. The far more common service, "exchange of crypto-assets for funds", works differently: there the provider is your counterparty. It quotes you a price and you take it or leave it.

Both are legal, both are regulated, and for many retail investors the broker model is in fact more convenient. The pricing simply works differently. In the register 170 providers may exchange against funds without running a trading platform. With them the margin sits in the spread, the gap between the buying and the selling quote, and that is rarely disclosed as clearly as a percentage fee.

Confusing the two models means comparing costs that are not comparable. That is precisely why our comparison of regulated crypto exchanges lists the legal entity and the actual trading costs separately for every provider.

Only half of them use the EU passport

MiCA's central promise is the European passport: an authorisation from one member state is valid across the single market. A provider authorised in Ireland may operate in Spain, Poland and Finland without a further procedure. In practice this is used far less often than expected.

The distribution splits into two camps with almost nothing in between. 125 authorisations cover exactly one country. 150 cover 25 countries or more, most of them 29 or 30. The middle is missing: only 49 providers sit somewhere between two and 24 countries.

Two very different business models sit behind that. One group are regional institutions, often banks, serving an existing client base with no interest in going abroad. The other are platforms that think in European terms from the outset and treat the passport as the actual reason for applying. For consumers this matters, because a provider holding a single national authorisation may not serve you if you live elsewhere.

The June peak and what followed

Plot the authorisations by month and a pattern emerges that supervisors know from other regulatory projects.

For a year and a half monthly authorisations moved in the low double digits. December 2025 brought a first spike to 44. Then, in June 2026, the last month before the deadline, 76 authorisations were granted, more than in the preceding five months combined. July brought 31, August three up to the register date.

The effect has an uncomfortable side. Firms that made it through in June often filed late. Supervisors had little time, and the review period of up to four months that MiCA allows for a complete file is likely to have been used to the limit in many cases.

For others the deadline became the exit. In July 2026 AscendEX, BitMEX and BitMart announced they would give up their EU business or close entirely. At BitMart trading ends on 26 August 2026 and the platform shuts on 31 January 2027. AscendEX ceased operations on 1 July, with withdrawals available only on a limited basis. Anyone still holding balances there should arrange to move them rather than wait for an extension.

The brand is not the legal entity

The most useful point in the register is also the easiest to miss. MiCA protection does not attach to a brand. It attaches to the specific legal person that received the authorisation, and that entity is almost never named after the app on your phone.

Kraken appears in the register as Payward Global Solutions Limited and Payward Europe Solutions Limited, both in Ireland. Crypto.com is listed as Foris DAX MT Limited in Malta. Behind Coinbase sits Coinbase Luxembourg S.A., behind the European Bybit entity Bybit EU GmbH in Austria. Bitpanda holds three authorisations: in Austria, in Germany and through BP23 CA Limited in Malta.

The one-minute check

Look in the terms and conditions or the legal notice to see which company you are actually contracting with. That is the name to search for in the register, not the brand. If the contracting party is based outside the EEA, MiCA protection does not apply, even where a sister company holds an EU authorisation.

What we noticed while working through the data

A word on data quality, because it explains why figures circulating about this register diverge. The field listing the authorised services is not filled in consistently. Most supervisors prefix the service letter, as in b. operation of a trading platform. In 20 of the 329 entries that letter is missing altogether, mostly in Cypriot and Estonian authorisations. Search for the letter alone and those entries drop out of the count, among them one trading platform.

At one German institution the letters are shifted by a position, so the text and the label no longer agree. One provider is entered twice with an identical record, and two French companies share the same LEI code. We therefore identified the services from the descriptive text and cross-checked the result against the letter-based method. The analysis script is on file with the newsroom.

None of this is a charge against ESMA, which consolidates what national authorities report. It is a reminder that any number drawn from this register should travel with the method that produced it.

Why we curate at all

A register answers the question of who may operate legally. It does not answer where it makes sense to trade. A Latvian payment provider with a single national authorisation and a pan-European trading venue are worlds apart, yet both sit in the same register and both may legitimately advertise as "MiCA licensed".

That is why we think a curated selection earns its place. Our comparison of MiCA-regulated crypto exchanges states for each provider the legal entity and the date of authorisation, each checked against the register. For a broader view there is the general exchange comparison; and anyone holding for the long run is independent of any platform's licence with a hardware wallet anyway.

What to take away

1. Check the legal entity, not the brand. Find out from the terms which company you are contracting with, then search that name in the ESMA register. It takes a minute and it is the only evidence that holds.
2. Establish whether you trade on a venue or against the provider. Only 21 authorisations cover the operation of a trading platform. Under the more common broker model the cost sits in the spread rather than in a stated fee. Our comparison of regulated exchanges reports both separately.
3. Move balances off platforms leaving the EU market. AscendEX, BitMEX and BitMart have announced their withdrawal. At BitMart trading ends on 26 August 2026. Waiting means negotiating later under time pressure.

Disclosure: some of the providers named in our comparison work with us through partner programmes. This has no bearing on the analysis of the ESMA register — every figure in this article comes from the official file and can be reproduced from it. Whether a provider is a partner changes nothing about its licence status.

This article is not investment advice and not a recommendation to buy or sell crypto-assets. Crypto-assets are highly volatile and a total loss is possible. Analysis as of 6 August 2026; ESMA register as of 4 August 2026.